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SUMMARY 


A failure in an aircraft control element must be accommodated in near real time 
by the pilot and/or automatic control system in order to prevent a possibly tragic 
accident. A first step in this accommodation is the detection and identification of 
the failure. This report presents the results of an evaluation of the failure detec- 
tion filter for the detection and identification of control element failures in 
transport aircraft. 

With the failure detection filter the vector of filter residuals for a given 
actuator type failure maintains a prescribed direction in measurement space. A 
residual processor, such as the correlator and threshold detector described in this 
work, can be used to detect the occurrence of a failure and to identify the failure. 
Such a failure detection filter was evaluated using a digital computer linear simula- 
tion of the longitudinal dynamics of a B-737 aircraft. The simulation included 
sensor errors and wind turbulence. 

With the thresholds set at a level determined by heavy clear air turbulence, 
approximately one half of the failures in the elevator, throttle, stabilizer, and 
spoiler were successfully detected. However, in heavy clear air turbulence and in 
thunderstorm turbulence all of the failures were detected, while in lesser turbulence 
none were detected. The primary reason for the missed detections at the lower turbu- 
lence levels was the necessity to set the thresholds sufficiently high to avoid false 
alarms in heavy turbulence during which the residual levels are increased. 

With some measurements, such as the acceleration measurements in this system, 
some actuator type failures feed directly into the measurement equation with the 
result that the filter residuals from these failures cannot be confined to a constant 
direction in measurement space. Also, with the state space formulation vised in this 
evaluation a steady state wind affects the filter residuals in the same way as does 
an actuator type failure. 

From the results of the simulation runs, it is concluded that false alarms/ 
missed detections due to wind turbulence are a significant problem which must be 
overcome before the failure detection filter and correlation processor can be used to 
detect and identify control element failures in transport aircraft. 


INTRODUCTION 

For certain anticipated failures in transport aircraft operations there are 
established procedures for the pilot to follow. A typical example is the procedure 
for handling an engine outage during takeoff. There are, however, unanticipated 
failure modes for which no appropriate emergency procedures will be available. These 
unanticipated failures must be handled by the pilot and/or the automatic control sys- 
tem in real time to decrease the probability of a tragic accident. 

In the case of a hard-over failure in a control element, the pilot may have only 
a matter of seconds to take corrective action before the aircraft reaches an irrecov- 
erable condition. In the case of a failure of lesser magnitude the pilot may have 
more time to take corrective action, but the failure and, hence, the proper 





corrective action may be difficult to identify. In either case the pilot may require 
assistance from the aircraft systems to help him take the appropriate corrective 
action in a timely manner. 

A considerable amount of work has been done in the area of failure detection and 
identification (FDI) in dynamic systems, and Willsky has provided a well known survey 
of many of the available FDI techniques (ref. 1). Chow (ref. 2) and Willsky and Chow 
(ref. 3) have examined the problem of generating residuals from the system measure- 
ment data for use in decision making processes to detect and identify failures. The 
detection of failures in sensors has been investigated by several authors, including 
Motyka, et al. (ref. 4); Deyst, et al. (ref. 5); Caglayan (ref. 6); and Friedland 
(ref. 7). The Generalized Likelihood Ratio has been investigated for FDI applica- 
tions by Willsky and Jones (ref. 8); Chow, Dunn, and Willsky (ref. 9); Bueno, et al. 
(ref. 10); Bueno (ref. 11); MIT (ref. 12); Liu and Jones (ref. 13); and Chang and 
Dunn (ref. 14). The technique has been exercised in a simplified simulation of the 
F-8 aircraft dynamics by Bueno and others at MIT (refs. 9-12), and Tylee (ref. 15) 
has examined the use of the GLR to detect failures in a nuclear reactor. Another FDI 
technique is the failure detection filter ( FDF) . Beard (ref. 16) developed the the- 
ory of the failure detection filter for linear deterministic continuous systems using 
a matrix algebra approach. Jones (ref. 17) extended this theory to stochastic and 
sampled data systems using a vector space approach. Messerole (ref. 18) has applied 
the failure detection filter to the problem of detecting and identifying failures in 
an FI 00 engine. 

This report presents the results of an evaluation of the capabilities of the 
failure detection filter for the detection and identification of control element 
failures in a transport aircraft. This evaluation was conducted primarily by imple- 
menting the failure detection filter in a linear simulation of the longitudinal 
dynamics of a B-737 aircraft and examining the performance of the filter in detecting 
step failures in the elevator, throttle, stabilizer, or spoilers. The text includes 
a development of the theory of the failure detection filter for fully measured sys- 
tems, a brief discussion of the aircraft simulation and the filter implementation, a 
presentation and discussion of the results, and conclusions. The aircraft simulation 
is discussed in detail in appendix A. The preprocessor used to transform the mea- 
surements into a form suitable for use by the failure detection filter is discussed 
in appendix B. 


SYMBOLS 


A 


A W 



B 


J W 


b 


system transition matrix 
wind system transition matrix 

acceleration in the x-, z-direction (body axes), ft/sec (sub-subscript s 
denotes stability axes) 

control input matrix 

i-th column of B 

wind system plant noise input matrix 
wing span, ft 
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b( • ) measurement bias error 

C w transformation matrix relating W to w and Vf^ to 

Cj correlation of filter residual with j-th output failure vector 

c^ correlation Cj normalized by multiplication by (1 - A)/|Hfj| 

c\' normalized correlation used in computing estimate of the failure magnitude 

c* correlation c! normalized by division by threshold e- 

3 3 .1 

^c^ correlation c| averaged over an N-sample data window 

D plant noise input matrix; failure detection filter gain 

F covariance matrix of the wind system plant noise £ 

fj_ failure vector 

G (s) filter transfer function 

H observation matrix 

Hp model of the observation matrix used in the filter 

h altitude, ft 

I identity matrix 

i index denoting the i-th failure vector from the set of constrained failure 

vectors 

k sample number 

L U ,L W , turbulence scales in the x- and z-directions , respectively, ft 
q perturbed inertial pitch rate, rad/sec 

q k filter error vector 

q w pitch rate due to wind, that is, rotation of the atmosphere about the 

y-axis, rad/sec 

N R k vector of filter residuals averaged over an N-sample data window 

covariance matrix of the plant noise 
R^ covariance matrix of the wind system plant noise ^ 

r^ vector of filter residuals 

r vector of steady state filter residuals 

b O 
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S <.),S 

s u (-) 

q 


u o 

U,U k 

u. (•) 
k 

u(0) 

u' 


u' 

w 


g s 
v a 
v k 

w,w k 
w( • ) 

w,w. 


w s (0) 


x,x, 


x k (,) 


*k 

^k 


z ' z k 


z k (,) 
a ' «k 

°w 


(•), power spectral density of the x-, angle-of-attack, and pitch rate- 
components, respectively, of the wind turbulence 

time, sec 

time at k-th sample, sec 

trim inertial velocity in x-direction, ft/sec 
control vector 

components of control vector u k 

steady state wind in the x-direction, ft/sec 

perturbed inertial speed in the x-direction normalized by the trim 
velocity U Q 

normalized speed in the x-direction due to wind, that is, normalized wind 
velocity in the negative x-direction 

gust and steady state components, respectively, of u^ 

airspeed, ft/sec 

observation, or sensor, noise vector 
wind system state vector 

components of wind system state vector W k 
wind, or plant noise, vector 

steady state wind in the z-direction, ft/sec 
system state vector 

component of system state vector x k 
estimate of the state vector x k 

in general, the observation, or measurement, vector; for the B-737 
simulation, the vector of pseudo-measurements after preprocessing 

value of the observation vector, or pseudo-measurement vector, predicted by 
the filter 

measurement vector from simulation prior to preprocessing 
component of the observation vector z k 

failure magnitude; perturbed inertial angle-of-attack, rad 
part of the angle-of-attack due to winds, rad 
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6s t 

6T 
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gust and steady state components, respectively, of o^, rad 
trim value of the angle-of-attack, rad 
disturbance transition matrix 

matrix coupling control element failure into the measurement equation 

disturbance transition matrix for the wind input w^ and defined by 
equation (A55) 

perturbed elevator position, deg 

unit impulse function 

perturbed stabilizer position, deg 

perturbed spoiler position, deg 

perturbed stabilizer command, deg 

perturbed thrust, klbs 

perturbed throttle command, deg 

detection threshold for correlation c! 

3 

wind disturbance vector defined by equation (A56) 
failure time, or sample number; perturbed pitch, rad 
trim value of pitch, rad 

angle between output event vectors Hf^ and Hf j 
filter eigenvalue 

wind system plant disturbance vector 

RMS velocities of wind turbulence in the x- and z-directions , respectively 
ft/sec 

time, sec 

system state transition matrix 
filter state transition matrix 
wind system state transition matrix 
control transition matrix 
filter control transition matrix 
i-th column of 



Q, spatial frequency, rad/ft 

0 ) temporal frequency, rad/sec 

Notation: 

A indicates estimated value 

F superscript F indicates that the variable is used in the filter 

formulation 

T superscript T denotes transpose 

E{* } expectation operator 

<*,*> vector inner product 

I j vector magnitude 

Acronyms : 

CAT Clear Air Turbulence 

FDF Failure Detection Filter 

FDI Failure Detection and Identification 

GLR Generalized Likelihood Ratio 

RMS Root-Mean-Square 


FAILURE DETECTION FILTER THEORY 

A failure detection filter (FDF) is a tracking filter, or state estimator, de- 
signed to assist in the detection and identif ication of a failure in a linear system 
by selecting the filter feedback gains such that the filter residuals always lie in a 
constant direction for a given failure (lie in a plane rather than a constant direc- 
tion for most sensor failures). The work by Beard (ref. 16) and Jones (ref. 17) was 
devoted to proving the existence of such a filter under certain conditions and to 
developing a procedure for accomplishing the filter design. 

The failure detection filter differs from many other tracking filters, such as 
the Kalman Filter, in the following way: although the failure detection filter is a 

state estimator, it is not designed primarily to minimize the tracking, or estima- 
tion, error, and therefore its estimation accuracy is not normally as good as a 
Kalman Filter. As an FDI technique, it differs from the Kalman Filter/Generalized 
Likelihood Ratio approach in that the FDF design does not depend on the time history 
of the failure magnitude as does the GLR. In other words, for a given failure type 
(direction in state space), the FDF design is independent of whether the failure 
amplitude is a step function, a ramp, or some other function of time. As an FDI tool 
the primary purpose of the FDF is to generate a vector sequence of residuals which 
must then be processed by decision making algorithms to declare the presence of a 
failure (detection) and to declare the type of failure (identification). These 
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decision algorithms may depend on the expected variation of the failure magnitude 
with time. 

Beard and Jones have developed the failure detection filter theory for a general 
linear system, but the theory for a fully measured system is considerably simplified. 
A fully measured system is defined as a system for which the number of independent 
measurements is equal to the number of system states, that is, r^fH) = n * The air- 
craft system investigated in this work is a fully measured system. 

Consider a noise free, linear, time-invariant, fully measured system with a 
failure described by the equations 




— <J>x^ * i — 1/2, •••/Li 


( 1 ) 




Y k+1 ~ Hx k+1 


( 2 ) 


where 


x-^ = n-dimensional state vector 

yy. = m-dimensional observation, or measurement, vector 
u k = r-dimensional control vector 

f| = n-dimensional failure vector describing the direction of the failure in 
state space 

i = index denoting the i-th failure from a set of L possible failures -s 

a k = failure magnitude 

<j> = nxn state transition matrix 

ij; = nxr control transition matrix 

H = mxn observation, or measurement, matrix 

A failure of a control element such as an actuator can be described by this model. 
For example, suppose that in this system the i-th element of u^. were the control 
input in degrees to an actuator. Then the failure vector f ^ for this actuator 
would be the i-th column of \p, and would be the magnitude of the failure in 

degrees. Many changes in plant dynamics also can be represented using the model in 
equation (1). Sensor failures require a different model and are not treated in this 
? report. 

A failure detection filter designed for such a system is described by 


\ + i = + n + °( y k - y J 
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(4) 


k+1 


= Hx. 


k+1 


where 

x^ = estimated n-dimensional state vector 

y k = predicted m-dimensional observation vector 

D = filter gain 

Define the filter error vector q k as follows: 




q k = x k " \ 


(5) 


From equations (1) through (4) the dynamics of the error are described by 


<ik+i = <K* k ~ \) - D (y k - y k ) + 

“(<!>“ DH)q k + c^f. 


( 6 ) 


The solution to equation (6) is 


q k+1 


k 

( ij) - DH) q^ + ^ 1 


(♦ “ 


DH) k j a.f. 

1 i 


(7) 


where q Q is the initial condition of q k . Since the true system state x k is 
unknown, this error is unobservable. However, the residual r k , defined by equa- 
tion (8) is observable. 


= y k ' 


= Hq k 


(3) 


k-1 


= H ( <{> - DH) k q + H ( (f> - DH) k- ^ _1 a.f. 

j=0 D 1 
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In general, the direction of r^ continually changes in residual space with time 
(sample number k) because of the repeated multiplication of the failure vector f^ 
by the matrix ( $ - DH) . 

Now let 


<J> - DH = XI 


(9) 


where the X's are the n eigenvalues of the matrix (<j> - DH) . Then equation (8) 
becomes 


r, = 


k-1 


\ k Hq + 
o 


E x k - j -Vf, 


j=0 


3 i 


( 10 ) 


For a stable filter, X is less than 1. Now as k increases, the transient term 
resulting from the initial condition approaches zero, and the residual becomes 


r k = 


k-1 

H E 

j=o 


a. f . 
3 i 


k-1 


j=0 


k-j-1 


a. Hf . 
3 i 


for large k 


(ID 


Note that after the initial transient has decayed, the residual is always in the 
direction Hfj as was desired. If the failure magnitude is a constant a, then 

the residual approaches a steady state magnitude as well as direction. 


aHf . 
i 

r ss f'-— X 

O 

From equation (9) the filter gain is found to be 

D = ( <j> - XI )H -1 for m = n and r^(H) - n 

D = ( (j> - XI)(H T H)- 1 H T for m > n and r^(H) = n 


( 12 ) 


(13) 

(14) 
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Equations (3) through (14) define the failure detection filter which will pro- 
duce a vector sequence of residuals r k< We now need a technique, or algorithm, for 
processing the residuals in order to detect the presence of a failure and to identify 
the failure. One of the simplest techniques would be to correlate the residuals with 

each of the output failure vectors Hf- and to select the vector f * corresponding 

J i 

to the largest correlation as the failure and to declare a failure if the correlation 
exceeds a threshold. Let the correlation be defined as 


c j = <Hfj,r k > 


(15) 


where <*,•> denotes the inner product. Substituting the steady state value for the 
residual from equation (12), the correlation becomes 


c 


j 


<Hf j , Hf 



(16) 


Using this technique, a mis-identif ication would occur if the failure vectors were 
such that <Hfj,Hf i > exceed <Hf i ,Hf i >. To avoid this difficulty, use the correla- 
tion defined by 


c'. 

D 


<Hf j ,r k > 


( 1 - X) 

Hf . 

3 


<Hfj,Hfi> | 

j 1 


(17) 


= | Hf £ | a cos 9j ^ 


where 0j^ = angle between the vectors Hfj and Hf^. Once the c^ , j = 1,2,...,L, 
are computed, the failure is identified as that vector corresponding to the largest 
normalized correlation, that is 


i = arg max c! 

j j 3 


(18) 


A failure is declared if and only if the correlation exceeds a threshold determined 
a priori by analysis and experiment, that is, if c« > 



If a failure is declared, the failure magnitude can be estimated using a 
different normalization of the correlation as follows: 


= <Hf A,r^> 


(1 - A) 

I Hf i t 2 


( 19 ) 


Note that 


a = 


Hf a 

i 


Hf , 


Hf • 


a cos 0* 
ii 


= a if i 


( 20 ) 


When the system includes plant noise (wind gusts) and sensor noise, the correla- 
tions will be random variables. Therefore, in a practical application a method is 
needed to reduce the variance of the correlations and thus reduce the false alarms, 
missed detections, and failure mis-identif Lcations . Perhaps the simplest method is 
to average the correlations over a window of N data points, or residuals. The 
averaged correlation becomes 


N 


c'. 

] 


<Hf j 'N 11 ^ 


(1 - A) 

I Hf . 

I 3 


(21 ) 


where 


N R k 



r k-n+1 


( 22 ) 


The estimates i 

R, in place of 
N k c 


and ci are computed as in equations (18) and (19) using 
c! and r k , respectively. 


c! and 
N 3 


Note from equation (17) that in the absence of noise the correlations c! and 
c'. differ by the factor cos . Thus the angle between the output failure vectors 

is a measure of the ease with which the failures can be correctly identified. 



EVALUATION OF THE FAILURE DETECTION FILTER VIA SIMULATION 


The Aircraft Simulation 

To achieve the objective of obtaining a preliminary evaluation of the capability 
of the failure detection filter to detect and identify failures in an aircraft con- 
trol system, the filter was implemented in a digital computer linear simulation of 
the longitudinal dynamics of a B-737 aircraft using a small perturbation model. 

These dynamics are described in state space by the equation 


x k+1 = **k + ^ u k + + + \ 


(23) 


The aircraft state vector is defined by 


-x k m- 


"0 ~ 

x k ( 2 ) 


u' 

x k (3) 


a 

x k (4) 


‘1 

x k (5) 


6T 

_ x k (6) . 


SS 


where 

0 = pitch attitude 

u' = normalized speed in the x-direction 
a = angle-of-attack 
q = pitch rate 
ST = thrust 

6S = stabilizer position 
The control vector is defined by 


X (1) ' 


*«e ‘ 

u k ( 2 ) 


6th 

u k {3) 


6s t 

5~~ 

<-> 


6sp_ 




(24) 


s 


( 25 ) 



where 


6 g = elevator command (= elevator position) 

6th = throttle command 

6s t = stabilizer command 

6sp = spoiler command (= spoiler position) 

The plant noise vectors w^ and represent the winds and will be discussed 

later. The state transition matrix <(>, the control transition matrix \p r and the 
disturbance transition matrix r were derived from the continuous time system 
matrices A, B, and D, respectively. The system matrices A, B, and D were 
computed from data supplied by the aircraft manufacturer for various aircraft trim 
conditions. All of the results discussed in this report were obtained for the 
aircraft trimmed for final approach with the exception of a few simulation runs to 
evaluate the effects of modeling errors. 

To evaluate the performance of the failure detection filter four types of fail- 
ures with three magnitudes for each type were simulated. These four types were step 
failures in the elevator, throttle, stabilizer, and spoiler. The failure vectors 
were derived from the control transition matrix for a step change of unity magnitude, 
for example for an elevator position change of one degree. The three magnitudes were 
chosen to represent a hard-over failure, a soft failure, and a failure of intermedi- 
ate magnitude. The failure types and magnitudes are listed in table I. Of course, 
these vectors change as the ijr-matrix changes with the aircraft trim conditions. 


TABLE I.- FAILURE TYPES AND MAGNITUDES 


Failure 

Type 

Magnitude 

Elevator 

Throttle 

Stabilizer 

Spoiler 

10°, 3°, 1° 

40°, 12°, 4° 

-6°, 3°, -1° 

8°, 3°, 1° 


The Wind Simulation 

To provide a realistic wind environment for evaluation of the failure detection 
filter the simulation included both turbulence, or gusts, and steady state winds. 

The gust components in normalized x-velocity, angle-of -attack, and pitch rate were 
modeled using the familiar Dryden spectra (ref. 19), which are 


s u («) 


2ct i 2 L 
u u 


i + (l n)‘ 

u 


(26) 
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(27) 


s a (n) 


a 2 h 
w w 


1 + 3(L Q,) 2 
w 

[i + (l n) 2 ] 2 

L W J 


s (n) 


2 2 

srv 

a 


1 + (4bfl/ir)' 


s (a) 

a 


(28) 


where 

= spatial frequency, ft 

b = wing span * 

= 93 ft 

V a = aircraft airspeed, ft/sec 

=216 ft/sec in the landing configuration simulated 

L ,L = turbulence scales in the x- and z-directions, respectively 
= 1750 ft 

a u ,a w - rms velocities of turbulence in the x- and z-directions, respectively, 
ft/sec 

After conversion from the frequency domain to the continuous time domain in 
state space followed by conversion to discrete time, the state equations for the wind 
system become 


w k+1 “ Vk + ?k 


(29) 


where 

W k = 6-dimensional wind state vector with W^(5) and W^(6) being the steady 
state components in angle-of-attack and normalized x-velocity, 
respectively 

^ = wind state transition matrix 

= zero mean, white, Gaussian random vector sequence « 

In order to provide a thorough evaluation of the FDF , a wide range of wind con- 
ditions were included in the simulation runs. RMS turbulence velocities correspond- 
ing to medium and heavy clear air turbulence (CAT) and to thunderstorm conditions * 

were simulated together with steady state winds. Calm (no wind/turbulence) condi- 
tions were also simulated. These conditions were summarized in table II. 
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TABLE II.- WIND CONDITIONS USED IN THE SIMULATION 


Turbulence 

conditions 

RMS 

velocity 

gust 
, ft/sec 

Steady 

wind, 

state 

ft/sec 

a u 

a w 

u s (0) 

o 

•w * 

w 

None 

0 

0 

0 

0 

Medium 

2.7 

2.7 

10 

0 

Heavy 

7.0 

7.0 

10 

0 

Thunderstorm 

— 

21 .0 

21 .0 

10, 39 

0 


The Measurements 

To enhance the capability to solve the FDI problem it was desired to provide a 
rather complete set of measurements for input to the failure detection filter. On 
the other hand, for the evaluation results to be credible, the measurement set must 
be technologically feasible, if not typical, for a modern day transport aircraft. 

The measurements selected for inclusion in the simulation are pitch attitude, x- and 
z-accelerations, pitch rate, airspeed, altitude rate, and angle-of-attack. The 
measurements formed a 7-dimensional measurement vector z^ defined by 


\<1)' 


CD 

U-j 

L 

z k< 2) 


f n\) 

z k<3) 


f H\) 

z k (4) 

= 


Z k (5) 


£ 5 ( V 

z k {6) 


f 6 (h) 

_ Z k (7) _ 


f 7 ( a) 


(30) 


The measurements z^(1) - Zj,(7) include errors such as noise, bias, scale factor, 

« and misalignment where appropriate. Numerical values for the errors are listed in 

table A.1 . 

The FDF requires measurements that are linear functions of the state variables, 

* that is, measurements that can be related to the state variables via the measurement 

matrix Hp. The measurements described by equation (30) do not meet this 

requirement since many of the functional relationships are non-linear. To circumvent 
this difficulty a pre-processor was used to transform the measurement vector into a 
vector of pseudo-measurements, or observations, y^ which could be approximated as 
linear functions of the states. A detailed description of the pre-processor and the 
Hp-matrix can be found in appendix B. 
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The Filter 


A 6-state failure detection filter was designed and implemented in the aircraft 
simulation for evaluation. The model of the B-737 aircraft used to design the filter 
is described by the equation 


x k+1 


<f>E*k + 


+F“k + 



i — 1 , ... ,4 


(31) 


The aircraft states and controls are the same as those used in the simulation. 




~ x k (1) ~ 


0 

x k (2) 


u' 

x k {3) 


a 

x k (4) 


q 

x k (5) 


6T 

_ x k (6) _ 

> 

6S 


where 

0 = pitch attitude 

u' = normalized speed in the x-direction 
a = angle-of-attack 
q = pitch rate 
<5T = thrust 

6S = stabilizer position 


» 


(32) 


"u k ( ir 


" 5 e ~ 

u k (2) 


6th 

u k (3) 


6s t 

l 

> 

i 


6sp 


(33) 
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where 


6e = elevator command (= elevator position) 

6th = throttle command 

6st = stabilizer command 

6sp = spoiler command (= spoiler position) 

The state transition matrix <j> p and the control transition matrix i|» F are 
« derived from the continuous time aircraft system matrices as discussed in appendix A, 

but they are designated with a subscript F to emphasize that the model used in the 
filter may be inaccurate and may differ from the matrices <j> and describing the 
actual aircraft (simulation). The effect of such inaccuracies have been explored 
briefly and are discussed in the results section. 

F 

The failure vectors f. correspond to failures in the elevator, throttle, sta- 
bilizer, and spoiler. The superscript F is used to denote that the vectors in the 
model are derived from the model control transition matrix and may differ from 

the failure vectors used in the simulation. 

Using the model just discussed the FOF is described by the equations 


*k+1 = <S>F X k + *F U k + D(y k " y k> 


y k+1 “ H F x k+1 


The filter gain was computed from 


d = <* F - ^>K H F r lH F 


(34) 


(35) 


(36) 


The FDF was evaluated using two gain matrices corresponding to values of 0.9 and 0.5 
for the eigenvalues X. 

At each iteration of the simulation the correlations c'. were computed for each 
of the four failure vectors using equation (17). The correlations were compared to 
the thresholds Ej to determine if a failure had occurred. Also, the normalized 
correlations c^ were computed by dividing by the appropriate thresholds. 

c* = c'./e. (37) 

3 3 3 


An equivalent detection criterion would be comparison of the normalized correlation 
c* to unity. If detection occurred, the failure was identified using two different 
3 
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algorithms to determine which produced better results. In the first algorithm the 
failure was identified (i was computed) using the correlations c! in equa- 

A J 

tion (18); that is, i was the value of i which maximized the correlation c* 
during the run. In the second algorithm the normalized correlation c* was used in 
place of c'. in equation (18); that is, i* was the value of i which maximized 
the normalized correlation c*. Two failure magnitudes were computed using equa- 
tion (19): one estimate using the correlations c! and the other using the nor- 

malized correlations c*. Using equations (21) ancl (22) these computations were 
performed for moving windows of 1, 10, 20, and 30 samples. The time of detection, 
that is, the time when the correlation first crossed the threshold, was recorded. 

The simulation was run at a sample rate of 20 iterations per second. Because 
the initial interest was in detecting and identifying catastrophic type failures, a 
quick reaction time was necessary. Thus, to evaluate the failure detection filter 
performance, only a few seconds of flight were required in a simulation run. With 
these constraints the aircraft could be flown open loop with no control system and 
still not diverge significantly from its nominal path before a failure was intro- 
duced. Therefore, to simplify the simulation the aircraft was flown open loop for 
all of the results discussed in this report. The aircraft was trimmed for final 
approach on a 3 degree glides lope. 

A total of 119 simulation runs were performed to exercise the failure detection 
filter. The results of these runs are presented and discussed in the next section. 


RESULTS 


This section presents and discusses the results of the simulation runs conducted 
to evaluate the performance of the failure detection filter. The first results are 
from the aircraft simulation discussed in the preceeding section and in more detail 
in appendix A in which the measurements are non-linear functions of the state. A 
preprocessor described in appendix B is used to transform the measurements into a 
form suitable for use by the FDF, that is, a form in which the measurements could be 
approximated by linear functions of the state variables. 

As discussed in the next sub-section the results led to an investigation via 
simulation of the filter performance using measurements which were strictly linear 
functions of the state (though some of these may not be physically realizable). 

These results together with some additional analytical results are presented and 
discussed in the second sub-section. 


Results Using Non-Linear Measurements 

Th reshol ds .- Using the filter gains corresponding to an eigenvalue of 0.5, three 
simulation runs of length 20 seconds each were made under conditions of heavy clear 
air turbulence (a u = ct w = 7 ft/sec) with no failures introduced into the system. 

Each run was made with a different seed number for the random number generator such 
that each run generated a different sample function, or sequence, for the wind tur- 
bulence and for the sensor noise. From the total of these three runs the largest 
values Ej computed for the correlations c! of the residual vector with each of 
the four output failure vectors using a 1 -sample window of data were selected for the 
1 -sample threshold values. Threshold values were similarly obtained from the same 
runs for windows of 10, 20, and 30 samples. Three 20 second runs were made rather 
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than a single 60 second run because the aircraft system tended to diverge too far 
from the trim conditions when operating open loop for longer times. A similar set of 
thresholds were obtained for the filter with an eigenvalue of 0.9. These thresholds 
were later used in the failure detection computation and in the calculation of the 

normalized correlations c*. 

: 

Using the 0.5 eigenvalue gains this procedure was repeated under conditions of 
no turbulence to obtain a set of threshold values which could be used in evaluating 
the effects of wind turbulence on the performance of the failure detection filter. 

It was realized that this procedure would not establish a statistically reliable 
threshold value suitable for actual aircraft operation. However, the values thus 
obtained were deemed reasonable for purposes of obtaining a preliminary evaluation of 
the performance of the failure detection filter for aircraft control system FDI and 
for uncovering potential problems in using the FDF for this purpose. 

Effect of eigenvalues .- Eleven simulation runs were made with each of the two 
filters (eigenvalues of 0.5 and 0.9) with various combinations of failures and wind 
turbulence levels. Detection performance is tabulated in tables III and IV and 
identification performance in tables VI and VII. For each filter the failures were 
detected in six of the eleven runs. They were correctly identified in four of the 
eleven runs using the maximum correlation criterion and in two runs using the maximum 
normalized correlation. The values for the normalized correlations c* are listed 
in tables VIII and IX to permit comparison between the two filters and to give an in- 
dication of the "signal-to-noise" ratio, or detection margin, for the filters. From 
this and the other data the differences in filter performance for the two eigenvalues 
were deemed insignificant in this case, and the filter gains producing an eigenvalue 
of 0.5 were used to generate the remaining results unless otherwise indicated. 

Failure detection performance .- Using the 0.5 eigenvalue filter, 28 simulation 
runs, including the 11 discussed in the previous paragraph, were made to evaluate the 
performance of the failure detection filter under various combinations of failures 
and turbulence standard deviations. The failures were all single point; that is, 
there were no multiple failures. Values for the correlation of the residuals with 
each of the four output failure vectors were computed at each iteration for 1-, 10-, 
20-, and 30-sample data windows. 

In 25 of the runs these correlation values were compared with the no turbulence 
threshold values to determine which failures were detected. The results, which are 
summarized in table V, show that 22 of the 25 failures were detected successfully. 
Three soft failures (the 1° elevator, the 4° throttle, and the -1° stabilizer) were 
not detected in zero turbulence. These failures were not detected because the 
thresholds values were previously determined by different sample sequences for the 
sensor noises, and the resulting thresholds were larger than the combination of fail- 
ure and sensor noise for the sample sequence used in the failure run. These results 
are very optimistic in that use of the no turbulence thresholds would produce a 
totally unacceptable false alarm rate. However, the results are useful when compared 
with later results to show the degradation in performance due to wind turbulence. 

The same correlation values were then compared with the thresholds obtained 
under conditions of heavy clear air turbulence, and the resulting detection perfor- 
mance is summarized in table IV. Under these conditions, that is, when the thresh- 
olds are set at the maximum correlation values obtained in heavy CAT with no failure, 
the failures were detected in 13 of 28 runs. Under conditions of heavy turbulence or 



thunderstorm turbulence all of the failures were detected. The throttle failures 
were detected with some, but not all, of the data windows; other failures were 
detected with all of the data windows. On the other hand, under conditions of medium 
turbulence or zero turbulence no failures were detected. In these cases the effect 
of the failure alone, even with a handover failure, was not sufficient to produce 
residual correlations which exceeded the thresholds. 

The correlation values c* for a 20-sample data window, normalized by the heavy 
CAT thresholds, are listed in table IX for 21 of the 28 runs. Examination of this 
data reveals that even though all of the failures in heavy CAT were detected, the 
detection margin was very small. The maximum value of c* was less than 1.4, and 
most of the values were less than 1.1. ■’ 

The instances in which failure detection occurred (not including thunderstorms) 
were examined to determine the time delay between failure occurrence and failure 
detection, that is, the time that it took after a failure for the correlation to 
cross the threshold. The results show that the mean detection time was 1 .6 seconds 
and that the detection times were generally longer for the larger data windows as 
would be expected. A more detailed analysis of the detection times is probably not 
warranted since the same sample sequences were used for the turbulence and sensor 
noises in all of the runs, and thus additional analysis would not result in an 
accurate statistical picture. 

Failure identif icatlon performance .- As previously discussed, two procedures 
were employed to perform the failure identification computations. One procedure 
selected the failure corresponding to the output event vector which produced the 
largest correlation value during the run. The other procedure selected the failure 
corresponding to the largest normalized correlation. 

The failure identification performance is summarized in table VII. Using the 
heavy CAT thresholds no failures were detected in zero turbulence and medium turbu- 
lence conditions, so failure identification was not attempted in these cases. In the 
13 heavy CAT and thunderstorm runs the failure was correctly identified in four runs 
using the maximum correlation criterion and in six runs using the maximum normalized 
correlation. Considering that there is an identification opportunity each time a 
failure is detected by a data window, there were 48 identification opportunities in 

these runs. Of the 48 opportunities 16 failures were correctly identified using the 

maximum correlation in the identification logic, and 9 were correctly identified 

using the maximum normalized correlation. From this data it is inconclusive as to 
which identification criterion produces better results, but both techniques performed 
poorly. 

Estimates of the failure magnitude were computed for each identification oppor- 
tunity, but these results were too poor to warrant further discussion. 

Time histories .- Time history plots of the actual system states from the sim- 
ulation and of the estimated states from the failure detection filter are shown in 
figures 1(a) and 1(b) for the case of no wind turbulence and the spoilers failed 
(stuck) at 8 degrees. Since there is no turbulence and no command input, the air- 
craft states are only slightly perturbed until the failure at t = 3 seconds. The 
action of the filter in tracking, or estimating, the system states can also be seen 
in these curves. The error in the estimate of the velocity u' is caused by the 
10 ft/sec steady state wind. Plots of the 1 -sample correlation of the residuals with 
each of the four possible output failure vectors are shown in figure 1(c). Also plot- 
ted are the correlations after normalization by the appropriate heavy CAT thresholds. 
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Similar plots of the correlations computed using a 20-sample data window are shown in 
figure 1(d). Note that none of the correlations cross the threshold, and thus no 
failure is detected during the 5 second run. The correlations are not calculated but 
are set to zero during the first 2 seconds of each run to allow the filter time to 
settle. The seven components of the residual vector are plotted in figure 1(e), 
where the effect of the failure on the residuals can be seen. Theory predicts that 
the residual vector should maintain a constant direction after the failure. Further- 
more, after the initial transient, for a step failure the residuals should attain a 
steady state value equal to a constant times the output event vector, or output fail- 
ure vector. Obviously neither of these conditions is true in this case. 

Figure 2 contains a similar set of plots for the same 8 degree spoiler failure 

in heavy turbulence. Note that in this case the combined action of the turbulence 
and the failure have caused the correlations to exceed the threshold, and thus a 

failure is detected by both the 1 -sample and the 20-sample windows. Note also that 

the 20-sample correlations are much smoother than the 1 -sample correlations as 
expected. The residuals are quite noisy, and the effect of the failure noticed in 
the no turbulence run is mostly obscured in this case. 

The failure detection and identification performance of the filter was not 
nearly as good as had been anticipated. Furthermore, the residuals did not behave in 
the expected manner as noted previously. In analyzing the filter in an attempt to 
explain these results it appeared that this behavior may be caused at least in part 
by the inaccuracies in the approximations made in the pre-processor in modeling the 
measurements as linear functions of the state variables. To better understand this 
effect the simulation was modified to produce a fictitious set of measurements 
according to the linear model, that is, measurements calculated using the H-matrix 
with the addition of sensor errors (noise, bias, etc.). A number of runs were made 
with this modification, and the results are presented in the next section. 


Results Using Linear Measurements 

Thresholds .- Using the simulation modified to produce linear measurements two 
new sets of threshold values for the filter, one set for no turbulence and one for 
heavy turbulence, were found employing the same procedure as before. These new 
thresholds were used in subsequent filter computations. The filter eigenvalues 
were 0.5. 

Failure detection performance .- Twenty-six simulation runs were made with vari- 
ous failures, turbulence levels, and steady state winds to evaluate the failure 
detection performance of the FDF when the filter input is a set of measurements which 
are accurately represented by the measurement model (H-matrix) except for sensor er- 
rors. As before, the residual correlation values from these runs were compared with 
the appropriate no turbulence thresholds to ascertain if a failure had been detected. 
The results, which are summarized in table X, show that .21 out of 26 failures were 
detected by at least one of the detection windows. All of the failures under condi- 
tions of medium or heavy turbulence were detected, and 3 of the 8 failures in zero 
turbulence were detected. 

The same values were compared to the heavy turbulence thresholds to evaluate the 
performance in a more realistic operating environment. These results, which are sum- 
marized in table XI, show that 11 out of 26 failures were detected, and five of these 
were spoiler failures. Only one throttle and one stabilizer failure were detected. 
Broken down by length of the data window, the results show that five, five, five and 



eleven oat of 26 failures were detected by the 30-, 20-, 10-, and 1-sample windows, 
respectively. These results were no better than those previously obtained with the 
non-linear measurements. 

The normalized correlations c* for a 20-sample data window are tabulated in 
table XIII. Significant detection margins were obtained only for the hardover 
spoiler failure. Other values of c* were close to unity; even for the undetected 
failures most of the values were greater than 0.9. 

ide n tification pe rform ance .- The failure identification results are 
summarized in table XII. In 26 identification opportunities (assuming heavy turbu- 
lence thresholds) only one failure was correctly identified using the maximum cor- 
relation value as an indicator. Only four of 26 were correctly identified using the 
maximum normalized correlation values. For these correct identifications the 
estimates of the failure magnitude were grossly inaccurate. 

Time histories.- Time history plots of the 1- and 20-sample correlations and the 
residuals for the case of an 8 degree spoiler failure in conditions of no wind turbu- 
lence are shown in figure 3. The correlations cross the threshold between 3 and 
4 seconds, and a failure is detected. If the criterion of maximum correlation is 
used to identify the failure, an elevator (failure 1) would be selected incorrectly. 
If the criterion of maximum normalized correlation is used, the 1 -sample correlation 
would indicate an elevator failure, and the 20-sample correlation would indicate a 
throttle failure (failure 2) . Both of these are incorrect. The residuals reach a 
steady state value in less than 1 second. However, there are significant residuals 
prior to the failure not predicted by the theory (eq. (8)). 

In this regard consider the system described by the equations 

*k+1 = **k + ^ u k + rw k (38) 
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(39) 


where 

T = plant disturbance (wind) input matrix 

w k = p-dimensional vector of plant disturbances (wind) 

With the failure detection filter defined as before, the filter residuals for this 
case are described by the difference equation 
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r k+1 = y k+1 “ y k+1 
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This equation has a solution 
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r k+1 = H U - OH) k+1 q o + H (<(> - DH) k_j rw. 
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( 41 ) 


If the winds are steady state only (w^ = w ), then the residual achieves a steady 
state value 


HIV 

o 
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Comparison of the pre-failure residuals in figure 3 with the steady state residuals 
computed^ from equation (42) for a 10 ft/sec steady state wind show excellent agree- 
ment. Thus, both the theory and the simulation results show that a steady state wind 
will propagate through the filter like an actuator type failure. This is not to say 
that the steady state wind effects can never be isolated from system failures. 

Plots of the residuals for an 3 degree spoiler failure with no steady state 
winds are shown in figure 4. In this case there are no significant residuals before 
the failure, but after the failure the residuals do not attain the steady state 
values predicted by equation (12), vis, otHf^/d - X). For an explanation of this 
discrepancy consider the following development. 

In certain systems some of the measurements are such that actuator type failures 
enter directly into the measurement equation. The acceleration measurements in the 
B-737 system discussed in this report are in this category. Consider the following 


(43) 


(44) 


formulation of such a system. 

x k+1 = ( t’ x k + ^ a k 
^k+1 = Hx k+1 + r H Bu k 


Suppose that a control surface fails in a manner that has the same effect as a com- 
mand 06^ in the i-th control input. Then the system is described by 


x k+1 = $ x k + + a k^i 


(45) 
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where 


gi u k (i) = r H B| 


u k (i) 


= r H B iUk (i) 


(47) 
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B^ = i-th column of B 


In a manner similar to the development of equation (10) the filter residuals in this 
case can be shown to be described by 
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Suppose that there are no command inputs and that the failure is a step failure of 
magnitude a at time zero. Then the steady state residual vector becomes 


Ha(^ i - 

r ss = 1 + ag i for X < 1 (49) 

* 


For the B-737 system the acceleration measurements y k (2) and y k (3) include 
control inputs from rows 2 and 3 of Bu k , as ia aquations (A64) for u' and a. 
Examination of the B-matrix reveals that only elevator and spoiler commands, and 
hence failures, affect u' and a. Throttle and stabilizer effects enter the 
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measurements through the A-matrix, since thrust and stabilizer position are system 
state variables. Thus, the matrix r H is given by 



(50) 


The resulting g 2 


and g-j are zero, and 
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Comparison of the residuals predicted by equation (49) for an 8 degree spoiler 
failure with the post-failure steady state residuals in figure 4 show very good 
agreement. 

Equations (48) show that for systems with measurements of this type the filter 
residuals are not constrained to a constant direction Hf^ as previously discussed 
but are constrained to the plane defined by the vectors Ht|^ and HDg^ . This 
characteristic increases the complexity of the failure identification process. 

In figure 5 are plots of the residuals for an 8 degree spoiler failure with no 
winds where the failure occurs as a ramp over 1 .5 seconds rather than a step as in 
previous cases. Here the residual vector appears to maintain a fairly constant 
direction during the failure as expected from the theory. 

In table XIV are the steady state correlations c'(j,k) for hardover failures, 
that is, the correlations of the output event vectors, or output failure vectors, 
with the steady state residuals for hardover failures, where the correlations were 
computed according to the equation 
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Values of j and k from 1 to 4 correspond to 10, 40, -6, and 8 degree failures of 
the elevator, throttle, stabilizer, and spoiler, respectively. Values of 5 and 6 
correspond to 10 ft/sec and 1 ft/sec steady state winds in the x- and z-directions, 
respectively. The winds were treated as failures as discussed in equations (38) 
through (42). The steady state residuals were computed using equation (49) for k 
equal to 1 through 4 and using equation (42) for k equal to 5 and 6. Note that in 
these results the actual failures 1 through 6 correspond to columns 1 through 6 and 
the assumed failures 1 through 6, that is, the output event vectors used to correlate 
with the residuals, correspond to rows 1 through 6. 

The results show that using the maximum correlation value as the criterion for 
identification an elevator failure (failure 1) would be incorrectly identified as a 
stabilizer failure (failure 3). Also, a spoiler failure would be incorrectly identi- 
fied as an elevator failure. This behavior is the result of the elevator and spoiler 
failures directly affecting the measurement equation and hence the residuals via the 
acceleration measurements. 

Model mis-match .- To assess the effects of inaccuracies in the filter model on 
FDF performance three runs were made using a different aircraft model in the filter 
than in the simulation. The model used in the filter was the landing configuration 
model previously used in the other runs, while the aircraft simulation used a model 
of the takeoff configuration. The three runs were similar to the runs used to deter- 
mine the thresholds; that is, each run lasted 20 seconds in heavy turbulence with no 
failure. 

False alarms were declared in two of the three runs. In other words, the filter 
model errors caused the correlations to exceed the thresholds and to falsely declare 
a failure in two of the runs. Further investigation is required to determine the 
amount of increase in the threshold levels needed as a function of the degree of 
model error to prevent a false alarm problem due to mis-match. It is reasonable to 
expect that different models may be required for operation in the different flight 
regimes. 


CONCLUSIONS 

The application of the failure detection filter to the detection and identifica- 
tion of control element failures in transport aircraft has been evaluated using a 
linear digital simulation of a B-737 airplane, with the thresholds set at a level 
determined by heavy clear air turbulence approximately one half of the failures in 
the elevator, throttle, stabilizer, and spoiler were successfully detected. However, 
in heavy CAT and in thunderstorms all of the failures were detected, while in lesser 
turbulence none were detected. 

The primary reason for the missed detections at the lower turbulence levels was 
the necessity to set the thresholds sufficiently high to avoid false alarms caused by 
wind turbulence. With the' thresholds set at a level determined by the sensor noise 
with zero turbulence 23 out of 25 failures were detected. Thus, with the FDF and 
correlation processor used in this evaluation the detection performance was affected 
as much by the turbulence as by the failure. 

The measurements used as inputs to the FDF were non-linear functions of the 
aircraft states. Replacing these with measurements which were linear functions of 
the states as modeled by the H-matrix did not result in significant improvement in 



filter performance. Further degradation in performance was caused by mis-match, or 
inaccuracies, in the aircraft model used in the FDF. 

With some measurements, such as the acceleration measurements in this system, 
some actuator type failures feed directly into the measurement equation with the 
result that the filter residuals from these failures cannot be confined to a constant 
direction in measurement space. Also, with the state space formulation used in this 
evaluation a steady state wind affects the filter residuals in the same way as does 
an actuator type failure. 

From the results of the simulation runs, it is concluded that false alarms/ 
missed detections due to wind turbulence are a significant problem which must be 
overcome before the failure detection filter and correlation processor can be used to 
detect and identify control element failures in a transport aircraft. 



APPENDIX A 


SIMULATION DESCRIPTION 
The Aircraft 

The system used to evaluate the failure detection filter was a discrete, linear, 
small perturbation simulation of the longitudinal channel of a B-737 aircraft similar 
to the simulation described by Halyo in reference 20. Much of the development in 
this appendix follows that by Halyo. The discrete system was derived from a continu- 
ous time system described by the following state equations: * 

x(t) = Ax(t) + Bu( t) + Dw(t) (A1 ) 


where the state vector x(t) is a 6-component vector defined as 
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and where the perturbed states are 
0 m pitch 

u* = normalized x-velocity 
a = angle-of-attack 
q = pitch rate 
6T = thrust 

6S = stabilizer deflection 

The thrust and stabilizer states were included to account for the engine spool 
up/spool down time and for the time constant in the stabilizer actuator. The command 
vector u(t) is defined by 
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where 

fie = elevator command (= elevator position) 
fith = throttle command 
fist = stabilizer command 

fisp = spoiler command (= spoiler position) 
The wind vector is defined by 
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(A4) 


where the wind components are 

u^ = normalized wind velocity in the negative x-direction 

oi^ = part of the angle-of-attack due to winds 

q w = rotation of the atmosphere about the y-axis 

Unless otherwise specified, the quantities are defined and the equations are written 
in the aircraft's stability axes. 

Values for the system matrices were obtained using a computer program (TCVOPL) 
which computes the aerodynamic coefficients for aircraft trim conditions specified by 
the program user. Exceptions to this procedure are the coefficients for the thrust 
and stabilizer states. Hie engine thrust is modeled as 


6T = A 55 6T + B^fith 


= -0.5 fiT + 0.298 fith 


(A5) 


The value 0.5 was approximated from engine data for the B-737. 

The response of the stabilizer on the B-737 is very slow. In order to have 
another control surface for restructurable controls, the time constant of the stabi- 
lizer was artificially shortened to make the surface useful. The stabilizer dynamics 
were assumed to be 


5S = AggfiS + B 63 5st 

= -0.667 6S + 0.667 fist 


(A6) 
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The Winds 


The wind effects on the aircraft are simulated by adding them to the other aero- 
dynamic forces acting on the aircraft. As noted in equation (A4) the wind is com- 
posed of x-velocity, angle-of -attack, and pitch rate components, and they include 
both steady state winds and wind gusts, or turbulence. 

The gust components are modeled using the familiar Dryden spectra (ref. 19), 
which are defined by the following: 
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In equations (A7) through (A10) cr and a are 
ties in the x- and z-axes, respectively, L u and 
these axes, b is the aircraft wingspan, is 
the spatial frequency of the turbulence, which is 
6) by 


the variances of the gust veloci- 
ty are the turbulence scales in 
the aircraft airspeed, and ft is 
related to the temporal frequency 
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In order to use these spectra in the simulation, which generates random gusts as a 
function of time, the spectra must be converted from functions of spatial frequency 
to functions of temporal frequency using the relationship 
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Angle-of-attack component .- Upon conversion to a function of o» the spectral 
density of ctg becomes 
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which can be factored into 
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Define a transfer function G a (s) using the realizable part of the spectrum in 
(A14). 
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A filter with this transfer function driven by white noise with a density 
will produce random gusts with the spectral density specified by equation 
with variance cr ^/ v ^* 

Let us now turn our attention to obtaining a set of state equations which de- 
scribe the filter specified by equations (A15). First convert the transfer function 
to an equivalent scalar differential equation. 
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Now let y = - ot g and = -£ in equation (A16), and let 


w i = y = _a g 
W, = w 2 + c 1 c 1 

W 2 = " 2(V a/ L w )w 2 “ (v a/ L w )2w 1 + c 2 ^i 
From equations (A17) find expressions for y and y. 

y - w 2 + c l «i 

y = -2(V a /L w )W 2 - (V a /L w ) 2 W 1 + c 2 5 , + 0,5, 

Substitute these in equation (A16), and solve for c 1 and c 2 . 
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Pitch component .- Upon conversion to a function of a> the power spectral 
density of the pitch gusts becomes 
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The wind gusts in pitch can be simulated by passing angle-of-attack gusts, that is 
the output of the filter G a (s), through a filter with a transfer function G (s) 
defined by 


G q (s) * 1 + (4b/*V ) s 

3. 


(A21 ) 


To obtain a state variable representation of the filter, first find the scalar 
differential equation equivalent of the transfer function G q (s). 
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Then 
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Therefore 
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X-axis component .- Upon conversion to a function of w the power spectral for 
the gusts along the x-axis becomes 
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3 * 1 + j(L /V )» 

V u a 

a 


1 - 


j (L /V )a) 
u a 


(A26) 
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2 3 

The x-axis gusts can be obtained by passing white noise with density 2L a /V 
through a filter with transfer function G u (s) defined by u u a 


G u (s) 1 + (L /V )s 


(A27) 


The corresponding scalar differential equation is 



(A28) 


► 

or in terms of state variables 


W 


4 “ 


u' 

g 


w. 




(A29) 


Steady state winds ,- Hie steady state winds have an x-axis component and an 
angle -of -attack component each of which is simulated as the output of a first order 
differential equation driven by white noise with a very small variance. This allows 
the winds to vary slightly during a run. Hie desired steady state wind velocities 
are used as the initial conditions. Mathematically the winds are described as 
follows: 


u' (t) = u' (0) = u <0)/U 

s 3 s so 

a (t) = F ; a (0) = w (0)/U 
s 4 s s o 


(A30) 


Wind state equations .- Equations (A17), 
to describe the total winds as follows: 


(A25), ( A29 ) , and (A30) can be combined 


4 


" = V* + 


► 

(A31) 
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where 





®W = 


(l - /T2) . (V^L^ 
0 
0 
0 
0 


0 

0 

0 

(V a/V 

0 

0 


0 

0 

0 

0 

1 

0 



(A32) 


(A33) 


(A34) 
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The covariance matrix of the Gaussian vector £ is 


F = E{££ T } 

0 0 

0 0 

1/V 3 0 

a 

0 00 1/V 3 

a 


a L /V I 
*• w w' a ' 


F = 


0 

0 


(2L a/v 3 ) 

u u a' 
0 


(A35) 


In the foregoing formulation the wind gusts through were written in 

aircraft body axes, and the steady state winds Wg and Wg were written in earth 
axes. They must be transformed into stability axes. Furthermore, the gust and 
steady state components must be added, and and must be combined according 

to equation (A2) in order to obtain proper wind forces acting on the aircraft. This 
can all be accomplished with the transformation as follows: 


V 


U 


w = C^W 


(A36) 


where 



"V 


rvi 


V + u ,_ 



w 


g s 

w = 

w 2 

, =3 

°w 

= 

n + a_ 
g s 


_ w 3_ 


_v 


- % . 


(A37) 


and 



-sin a Q 

0 

0 

-cos Oq -cos(e o 

- a 0 + e) 

sin(e o - a Q 

c w ^ 

-cos a Q 

0 

0 

sin a Q -sin(e Q 

<D 

+ 

«° 

-cos ( 0 O - a c 


-(irV a /4b) 

0 

UV a /4b) 

0 

0 

0 


(A38) 
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Discrete State Equations 


The state equations for the aircraft and winds have been written as functions of 
continuous time t. These equations need to be coverted to functions of discrete 
time t k for use in a digital computer simulation. Such a discretization has been 
discussed by Halyo (ref. 20). 


Consider the aircraft continuous time state equation (A1 ) . If the state is 
known at time t k , the state at time t k+1 = t k + T can be found by integration over 


the interval t k to t k+1 


The result is shown in many texts (e.g., ref. 21) to be 


x(t k+1 ) = ♦<t k+ 1 ,t k )x(t k ) + 


k+1 ' k 


L 


^+1 


<|>(tk +1 > t)Bu( x) dx 


k+1 


+ J <|>(t k+1 , t)Dw( t) dx 


(A39) 


where 


♦<t, T ) - 


To simplify the notation, let x(t k ) be denoted by x k , and assume that the command 
u(t) is constant over the integral t k < t < t k+1 . Then 


x k+1 


= ${k + 1 





t) dr Bu^ 


+ 



<j)(t k+1 , t)Dw( t) dx 


The 


integral 



* (t k+l' T) dT 


can be expressed as 


(A40) 



(A41 ) 
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If A has an inverse A -1 , then 


e 


\+1 _ A ( t k + 1 ~ T) 
k 


- t, At k+1 f^+l -At -1 . 

di B = e I e A d(Ax)B 

J t. 


At k+l[ “ At k+1 “ At kl -1 
= e L-e + e Ja 1 


= [ (j)(k + 1 ,k) - I]A“ 1 B 


The aircraft state equation now becomes 


x k+1 " * x k + 



<j>( t^ + 1 , t)Ow( t) dx 


To evaluate the integral involving the wind w(x), we first convert the 
continuous time wind state equation (A31) to discrete time. 


W = A W W + B w 5 


Upon integration this becomes 


w k+1 = + 


where ^ is the state transition matrix for the wind system. 


= ^(k + 1, k) 
A W (t k+l” t k ) 

= e 


(A42) 




(A43) 


(A31) 


(A44) 


(A45) 
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and 


s k - y<w r) V (t) dT 


(A46) 


. P V T ' T,B « E<t k + * 
Jo 


) dx 


Halyo (ref. 20) has shown that £ k is a Gaussian white noise vector sequence with 


covariance R^. 


R 5 (k,j) = 


= E 


ic v T -> B w 


£(t k + t) dx 


•/>» 


+ s)bV( T ,s) ds> (A47) 
W T W 1 


■I 


n T 


t fc + x)£ T (t.. + s) • B^(T,s) dx ds 


Since £(t) is a white noise process, and since the intervals + T) and 


(tj,tj + T) do not overlap for j*k, 


E{e(t k + x)? (t. + s) 


(0 j * 

) = 

\ F 6 ( x - s) j = 


* k 
k 


(A48) 


Therefore, 


R^(k,j ) - 


(A49) 



yT,s)B w FB^ w (T,s) ds 


(A50) 
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The matrix C^, which transforms the continuous time wind variables W into the 
variables w for use as the plant noise in the aircraft state equations, is still 
valid for the discrete case. Thus 


w k = Wk 


(A51) 


We now return to the evaluation of the integral in equation (A43) involving the 
wind w( t) . A change of variables produces 



♦ (tj^l ,t)Dw(t> <3t = 



+ s) 


ds 


(A52) 


* 


* 


After substitution of equation (A36), integration of equation (A44) from 0 to T, and 
substitution of equation (A46), the integral becomes 



$(T,s)Dw(t^ +s) 


ds 



<j>(T,s)DC w <|> w (s,0) ds W k 


+ 



^(T,s)DC w 



)B W 5(t k + T) dT dS 


The aircraft state equation can now be written as 


(A53) 


x k+1 = + x k + +«k + F W W k + *k 


(A54) 


where 


■w -/ 

Jo 


r w = I <).(T,s)DC w <(> w (s,0) ds 


(A55) 


and 


^ - /: <(.(T,S)DC W j VS'T^W 5 ^ + T) 


dx ds 


(A56) 


The sequence is a Gaussian white noise vector sequence with covariance R^. 
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R n (k, j ) = E{n k rij } 


n T 

♦ (T/SJDC^s, 


t) ds B w £( fc k + t) dx 


r t /*t 

+ y)B^ J *J(x,y)cJ+ T (T f x) dx dy 


m T 

<t>(T,s)DC w <fr w (s,x) ds B w E{§( 

; 

r t 

TIT T T T 

• B w I + w (x,y)C w D <j> (T,x) dx dy dx 

-Jy 


t k + x)5 + y) 


As we noted previously in equation (A48), 


■ + T) 5 T (t j + y)} 


jO j * 

(f«(t - y) j - 


Therefore 


V j ' k) - R n 6 


n°jk 




(|)(T,s)DC w 4» w (s,x) ds 


T 

B FB 
W W 


jj* T {(x,x)cJd t * t (t, 


x) dx 


dx 


This completes the discretization of the state equations necessary to 
the aircraft and winds. 


(A57) 


} 


(A58) 


(A59) 


(A60) 


simulate 
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Measurements 


Thus far we have described the simulation of the aircraft dynamics and of the 
winds acting on the aircraft. For the purposes of the work discussed in this report 
the simulation needs one additional element - simulation of the measurements, or air- 
craft sensor outputs. 

The measurements of interest are pitch attitude from a pitch gyro, x- and 
z-accelerations from body mounted accelerometers, pitch rate from a pitch rate gyro, 
airspeed and altitude rate from the air data computer, and angle-of-attack from an 
angle-of -attack vane. A reasonably accurate simulation requires computation of the 
true value of the quantity being measured and then the addition of appropriate > 

errors. For each measurement these errors include some, but not necessarily all, of 
the following: bias, white noise, scale factor, and alignment. The true values and 
errors are combined at each sample time t k to form a measurement vector z k . 


V 1 * 

z k <2) 


z k - 


(A61 ) 


2 k< 7 > 


Pitch.- The pitch measurement includes additive noise and bias errors. 


z k ( 1 ) = 6 + v fc ( 1 ) + b( 1 ) 


( A62 ) 


where 


0 = pitch = x k (1) 
b( 1 ) = 0.23° 

v k (1) = zero mean white Gaussian noise ^ 

e{v£(1 ) } = (0.23 0 ) 2 

Accelerations .- The x- and z-axis acceleration measurements include noise, bias, * 

scale factor, and misalignment errors. The first step in obtaining a simulated mea- 
surement is to compute the true value of the acceleration in stability coordinates, 

A„ and A„ , from the equations of motion. 

x 0 Z Q 
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(A63) 


A x = U Q u' + qU Q tan a + g sin( 0 Q + 0 - a Q ) 


A z = U Q [u' tan a + (1 + u')a / cos2 a] - qU Q - g cos ( 0 Q + 0 - a Q ) 


where 


g = acceleration due to gravity 
U Q = trim inertial velocity along x 
0 Q = trim pitch attitude 
o^j = trim angle-of-attack 
0 = perturbed pitch = x^O) 

u' = perturbed inertial velocity along x = x^( 2 ) 
a = perturbed inertial angle of attack = x^( 3) 
q = perturbed pitch rate = x^(4) 

At any time t^ values of x^ are known from the aircraft state equation. The 
quantities u' and o are calculated using the coefficients from the continuous 
time state equation. 


u' = £[»** * * D» k ] 


a - + 81 ^+ Dw k ] 


where 


el = [0 1 0 0 0 0] 


£, = [0 0 1 0 0 0 ] 


(A64) 
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These stability axis accelerations are transformed into body axis accelerations, and 
the effects of accelerometer misalignment are added as follows: 


A = a cos (a n + a) - A sin( a n + a) 
x b ^s ° z s ° 


A = sin(« + a) + A cos(a rt + a) 

tlu X_ O ^ O 

os s 


(A65) 


where 


a = accelerometer alignment error =0.2° 

K 

Noise, bias, and scale factor errors are added to obtain the acceleration 
measurements . 


z k (2) 

z k (3) 



+ v k (2) + b(2)J 
+ v k <3) + b(3)J 


(1 + s) 


(1 + s) 


(A66) 


where 

s = scale factor error = .0025 
b(2) = b( 3) = bias =0.32 ft/sec 2 
v k (2),v k (3) = zero mean Gaussian noise 
e{v 2 (2)} ■ e{v 2 (3)} = (0 * 32 ft/sec 2 ) 2 

Pitch rate .- The pitch rate measurement includes only a noise error. 

z k (4) = q + v k ( 4) (A67) 


where 

q = pitch rate = x k (4) 

v k (4) = zero mean Gaussian noise 

e{v 2 (4)} = (.02 deg/sec) 2 


** 
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Air speed .- The air speed measurement includes a multiplicative noise error and 
a bias. 


z k {5) = V a [l + v r (5) ] + b( 5) (A68) 

where 

V a * U 0 (1 + u ' + u^)/cos(a + a^) 

u" * normalized inertial velocity along x = x k (2) 

u^ = normalized wind velocity along x = w k (1) 

a = angle-of-attack due to inertial velocity along z = x k (3) 

(fy = angle-of-attack due to wind velocity along z = w k ( 2 ) 
b(5) = 3 kts 

v k(5) = zero mean Gaussian noise 
e{v£< 5) } a (0.02) 2 

Altltutde rate.- The altitude rate measurement includes only a noise error. 


z k (6) 


h + v k (6) 


(A69) 


where 

h = u (1 + u')[sin(e + 0 - a ) - tan a cos(9 + 9 - a )1 
o i o o o o J 

v k (6) = zero mean Gaussian noise 
e{v 2 (6)} = (5 ft/sec) 2 

Angle-of-attack .- The angle-of-attack measurement includes bias and additive 
noise errors. 

z k (7) = a + + V]t (7) + b(7) (A70) 


where a and were previously defined, and v k (7) is zero mean Gaussian noise. 

The bias b(7) and noise error variance were estimated to be 0.25° and (0.4°)^, 
respectively. 
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The measurement errors are summarized in table A1 


TABLE A1 MEASUREMENT ERRORS 




Error type 


Measurement 

Noise 
s tandard 
deviation 

Bias 

Scale 

factor 

Alignment 

Pitch 

0.23° 

0.23° 

- 

- 

Acceleration 

0.32 

sec^ 

0.32 

sec 

0.0025* 

O 

CM 

• 

O 

Pitch rate 

0.02 

sec 

- 

- 

- 

Air speed 

0.02* 

3.0 kts 

- 

- 

Altitude rate 

5 1 £- . 
sec 

- 

- 

- 

Angle-of -attack 

0.4° 

0.25° 

- 

- 


♦multiplicative 


Implementation 

Implementation of these equations into the simulation requires evaluation of the 
integrals in the expressions for r w , R^, and in equations (A55), (A50) , and 

( A60) , respectively. lhe integrals in equations (A55) and (A50) and the inner inte- 
grals in equation (A60) were evaluated using a Langley software library subroutine 
GLEGEN, which performs numerical integration using a Gauss-Legendre formula. The 
outer integral in equation (A60) was evaluated using the library subroutine SIMP, 
which performs numerical integration using Simpson's formula. In all cases, the 
aircraft transition matrix was evaluated using the library subroutine CONEXP, which 
computes the matrix exponential. 

Random sequences .- The random sequences 5^ and have correlation matrices 

R^ and R^ defined by equations (A50) and (A60), respectively. In general, these 
matrices are not diagonal, and thus the components £^(1), ^( 2 ), ..., 5^(6) of the _ 

vector 5^ are not independent as they were with the vector ?(t) in the continuous 
time case. This is also true of the components n^O), ( 2 ) , . .., of 

At time t^ the simulation generates a vector of 6 random numbers with * 

covariance matrix R^ using the following technique. Let x be a vector of zero 


46 




mean, independent, Gaussian random variables with unity variance. Then the correla- 
tion matrix R x is 


R x = E{xx T } 


= I 


(A71) 


Let y be the vector of desired zero mean random variables y 1 , y 2 , ..., y N with 
the covariance matrix Ry. Now let the desired random vector y be given by 


y = Gx 


(A72) 


where the transformation G is defined to produce the desired covariance of y, that 
is 


E{yy T } = E{Gxx T G T } 


T T 

= GE{xx }G 


(A73) 


= GG T 

Therefore 

GG T = Ry (A74) 

If G is assumed to be triangular, one solution (of many) to equation (A74) is given 
by the following: 

y i = g 11 x 1 

y 2 = g 2lXl + g 22 x 2 

. (A75) 


y N ~ g N1 X 1 + %2 X 2 + ••• + 
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Then 


E t y ?) = <J?, 

E ( y 2 y i ) " *21 * » 11«21 

E t y 2 J ' R 22 ‘ *21 + g 22 


•rtiis system of equations can be solved for the elements g^j 


to give 


g 11 



g j1 = 


2 < j < N 



1 < i < j 


(A77) 


j j 


5-1 




2 < j < N 


The same technique is used to generate the vector of random numbers with 

covariance R^. 

Failures .- Failures in the control elements were simulated as steps or ramps in 
the state variables according to 


x k+l = * x k + *«k + rv^k + ^k + a k f i 6 k+1,0 


(A78) 
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where 


f i = 


= i-th column of the control transition matrix, 
and is chosen to be a step or ramp. 

Because the acceleration measurements z k (2) and z k (3) contain terms which 
include the continuous time control input matrix B as in equations (A64) through 
(A66), any failure affecting these terms must be accounted for in the simulated mea- 
surements. For the four failures simulated, only the elevator and spoiler failures 
affected the B-matrix and thus introduced failure effects directly into the measure- 
ment equation via the expressions for u' and a. For a stuck actuator these 
effects were simulated by adding terms to equation (A64) as follows: 


;• - + D» k + - VI”! 

4 + B \ + % + B i ta k - V 1 ”! 


(A79) 


where 


=> i-th column of B 

u k (i) — i-th component of the control vector u k 

The term B^a^ accounts for the failure and the term B ^u k (i) accounts for the loss 
of that control input. 


4 
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APPENDIX B 


THE PRE-PROCESSOR 

The failure detection filter requires input measurements that can be expressed 
as linear functions of the state variables as in equation (35). As noted in the 
text, the actual measurements z k do not meet this requirement. A pre-processor was 
used to obtain from the measurements a set of pseudo-measurements y k which could be 
approximated by a linear model. This pre-processor is described in the following 
paragraphs . 

Not only are the actual measurements non-linear functions of the state variables 
in some cases, but some measurements are functions of the winds, which are not 
included in the filter state vector. Therefore, one of the approximations that must 
be made in obtaining a linear model of the measurements is to neglect any wind 
dependencies . 

Pitch.- From equation (A62) the output of the pitch attitude gyro is 


z k (1) = 9 = v k (1) + b(1 ) 


In this case it suffices to let 


and then 


y k (i ) = z k (i ) 

y k (1) can be modeled as 
y k (1 ) = 0 + v k (l ) 

= x k ( 1 ) + v k ( 1 ) 


(B1 ) 


(B2) 


Accelerations .- The outputs of the body mounted accelerometers are given by 
equations (A63) - (A66). The first step in pre-processing this measurement is to 
convert them to stability coordinates according to 


F F F 

A = z, (2) cos a + z. (3) sin a 
x k ok o 

s 

(B3) 

F F F 

A = -z, (2) sin a + z. (3) cos a 
z k ox o 

s 
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where 


a Q = trim angle-of-attack 

Comparison of the stability axis accelerations in equations (B3) with those in (A65) 
shows that 


V = Ax + e x 

s s 


- A z + e z 

3 S 


(B4) 


where e x is an error term due to accelerometer noise v^(2), bias error b(2), 
scale factor error s, accelerometer alignment error a, and error (a - a F ) in the 
trim angle-of-attack. From equations (A63) and (A64) 


F T 

A^ = U q e 2 [A 3 ^ + Bu ] c + ] + qU Q tan a + g sin(0 Q + 0 - a Q ) 

s 

(B5) 

h l = U o ten a€ 2 ^ + Dw k ] - qU Q - g cos(0 o + 0 - a Q > 

s 


+ [(1 + u')U o /cos 2 o]e^[Ax k + Bu k + Dw k ] 


Define the observations y^(2) and y^(3) as follows: 


y k (2) = ^p[ A x g “ g Sin ^ 0 o " a o)] “ £ 2 B F U > 


(B6) 


*k (3) = -tR + 9 cos(0 B - /) 
U l_ s 


T„ 

- SVk 


The pre-processor then calculates the observations y k (2) and y^(3) from the mea- 
surements z k (2) and z^O) using equations (B3) and (B6). From equations (B5) 
and (B6) these observations can be approximated as linear functions of the states as 
follows: 
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T F F F 

y k (2) « q tan a + e 2 A F X k + ( g / U o) cos ( 9 0 “ a 0 ) sin ® + v k^ 2 ^ 

6 

* HL A p (2,j)x k (j) + (g/u^) cos(e^ - /)x k (D + v k (2) 

j=1 

y k (3) * -q + (tan a) e^F 34 ^ + K 1 + u' )/cos 2 al e^ApXj^ + v k (3) 

+ (g/oj) sin(e^ - /) sin 0 

6 

« -3^(4) + (g/U^) sin(e^ - aJ^O) + S A P (3 ' j)x k (:i> + v k (3) 

Pitch rate .- From equation (A64) the output of the pitch rate gyro is 
z k (4) = q + v k (4) 

It is sufficient to let 
y k (4) = z k (4) 

in which case y(4) can be modeled as 
y k (4) = x k (4) + v k (4) 

Air speed .- From equation (A68) the air speed measurement is 
z k (5) « V a [1 + v k (5)J + b(5) 

= U Q [ ( 1 + u' + u^)/cos(a + 0^)3 • Cl + v k ( 5 ) ] + b ( 5 ) 

Define the air speed observation as 
y k <5> - [z k (5)//] - i 


(B7) 


(B8) 


(B9) 


(BIO) 


(BID 
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The observation can be approximated as a linear combination of the states as follows: 


y k (5) = 


1 + u' + u' 
w 


cos( a + a ) 
w 


[1 + v k (5)3 + - 1 


o 

* u' + v k (5) 

“ x k (2) + v k (5) 

Altitude rate .- From equation (A69) the altitude rate measurement is 
z k (6) = h + v k (6) 

= U Q (1 + u£)[sin(e o + 0 - a Q ) - tan a cos(0 o + 0 - a Q )l + v k (6) 


Define the observation 


y k (6) - [•*(«>/<£] - (ej * 4)- 


which can be approximately modeled as 


y k (6) * (1 + u , )[sin(9 Q - a Q ) cos 0 + cos(9 q - a Q ) sin 9 


F F- 


J3* p p p 

- tan a cos f 9 - 0 ) cos 0 + tan a sin (9 - a 1 sin 9l 

v o O' J 


o o- 


- V6>/°o - « - «o) 


F F F F 

u' sin(0 Q - a Q ) + cos^ - 0^)9 - a + v t (6) 


o o • 


G - “oK {2) + \ (1) ~ x k (3) + V 6) 


(B12) 


(B13) 


(B14) 
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is 


Angle-of-attack From equation (A70) the output of the angle-of -attack sensor 


z fc (7) = a + cfy + v^(7) + b(7) 


Define the observation 


y k (7) ■ z k (7) 

which can be modeled by 

y k (7) = a + Ojj + v k (7) 

- x k (3) + v k (7) 


> 


i 


(B16) 


The pre-processor computes the observations y k from the measurements z k ac- 
cording to equations (B1-), (B3), (B6), (B9), (B11), (B13), and (B15). Hiese observa- 
tions are the inputs to the failure detection filter. For use in the filter 
algorithms the observations can now be expressed as in equation (35) with the 
Observation matrix defined by equation (B17). 


1 


0 

0 

0 

0 

0 ~ 

Apt 2, 1 ) + 

g/Uo c °s(0o - 

«o) 

Ap ( 2 , 2 ) 

Ap( 2, 3) 

Ap ( 2 , 4 ) 

Ap ( 2 , 5 ) 

A p (2,6) 

Ap( 3,1) + 
g/ u o sin ( 0 o - 

■S) 

Ap ( 3 , 2 ) 

Ap ( 3 , 3 ) 

Ap ( 3 , 4 ) 
-1 

Ap ( 3 , 5 ) 

Ap (3,6) 

0 


0 

0 

1 

0 

0 

0 


1 

0 

0 

0 

0 

i 


( 0 I ■ °£) 

0 

0 

0 

0 

_ 0 


0 

1 

0 

0 

0 _ 
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TABLE III.- FAILURE DETECTION PERFORMANCE WITH AN EIGENVALUE OF 
0.9 AND THRESHOLDS SET AT HEAVY TURBULENCE LEVEL 
k 


Failure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

Heavy 

Thunderstorm 

Elevator 

10 


n/n/n/n 

Y/Y/Y/Y 

Y/Y/Y/Y 


3 

n/n/n/n 

n/n/n/n 

Y/n/n/n 



1 

n/n/n/n 

n/n/n/n 



Throttle 

40 



Y/Y/Y/Y 



12 






4 





Stabilizer 

-6 



Y/Y/Y/Y 



3 






-1 





Spoiler 

8 



Y/Y/Y/Y 



3 

1 






Y/Y/Y/Y indicates detection using the 30-, 20-, 10-, and 1-sample 
windows. 

n indicates failure not detected. 


« 


4 

























TABLE IV.- FAILURE DETECTION PERFORMANCE WITH AN EIGENVALUE OF 
0.5 AND THRESHOLDS SET AT HEAVY TUBULENCE LEVEL 


Failure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

Heavy 

Thunderstorm 

Elevator 

10 

n/n/n/n 

n/n/n/n 

Y/Y/Y/Y 

Y/Y/Y/Y 


3 

n/n/n/n 

n/n/n/n 

Y/Y/Y/Y 



1 

n/n/n/n 

n/n/n/n 

Y/Y/Y/Y 


Throttle 

40 

n/n/n/n 

n/n/n/n 

n/Y/Y/Y 



12 



n/Y/Y/Y 



4 

n/n/n/n 


n/Y/n/Y 


Stabilizer 

-6 

n/n/n/n 

n/n/n/n 

Y/Y/Y/Y 



3 



Y/Y/Y/Y 



-1 

n/n/n/n 


Y/Y/Y/Y 


Spoi ler 

8 

n/n/n/n 

n/n/n/n 

Y/Y/Y/Y 



3 



Y/Y/Y/Y 



1 

n/n/n/n 


Y/Y/Y/Y 



Y/Y/Y/Y indicates detection using the 30- , 20- , 10-, and 1 -sample 
windows. 

n indicates failure not detected. 



TABLE V.- FAILURE DETECTION PERFORMANCE WITH AN EIGENVALUE OF 
0.5 AND THRESHOLDS SET AT NO TURBULENCE LEVEL 


Fai lure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

Heavy 

Thunderstorm 

Elevator 

10 

n/n/n/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 


3 



Y/Y/Y/Y 



1 

n/n/n/Y 


Y/Y/Y/Y 


Throttle 

40 

Y/n/n/n 

Y/Y/Y/Y 

Y/Y/Y/Y 



12 



Y/Y/Y/Y 



4 

n/n/n/n 


Y/Y/Y/Y 


Stabilizer 

-6 

Y/Y/Y/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 



3 



Y/Y/Y/Y 



-1 

n/n/n/n 


Y/Y/Y/Y 


Spoiler 

8 

Y/Y/Y/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 



3 



Y/Y/Y/Y 



1 

Y/Y/Y/Y 


Y/Y/Y/Y 



Y/Y/Y/Y indicates detection using the 30- , 20- , 10-, and 1 -sample 
windows . 

n indicates failure not detected. 
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TABLE VI.- FAILURE IDENTIFICATION PERFORMANCE WITH AN EIGENVALUE OF 
0.9: FAILURE CORRECTLY IDENTIFIED 



Y/Y/Y/Y indicates correct identification using the 30-, 20-, 10-, 
and 1 -sample data windows. 

n indicates failure not correctly identified. 

i indicates identification based on maximum value of correlation. 
I indicates identification based on maximum value of normalized 
correlation. 

* indicates failure not detected. 


* 


* 
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TABLE VII.- FAILURE IDENTIFICATION PERFORMANCE WITH AN EIGENVALUE 
OF 0.5: FAILURE CORRECTLY IDENTIFIED 


-a 


a 


a 


Failure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

Heavy 

Thunderstorm 

Elevator 

10 

*/*/*/* 

* /* /* /* 

i: Y/Y/Y/Y 
i:n/n/n/n 

i: Y/Y/Y/Y 
i : n/n/n/n 


3 

*/*/*/* 

* /* /* /* 

i: Y/Y/Y/Y 
i:n/n/Y/n 



1 

*/*/*/* 

* /* /* /* 

i: Y/Y/Y/Y 
I:n/Y/Y/n 


Throttle 

40 

k Jk 

* /* /* /* 

A 

i : * /n/n/n 
i : */n/n/Y 



12 



i : * /n/n/n 
i : */n/n/Y 



4 

*/*/*/* 


i:*/n/*/n 

i:*/n/*/Y 


Stabilizer 

-6 

* /* /* /* 

* /* /* /* 

A 

i : n/n/n/n 
i : n/n/n/n 



3 



i : n/n/n/n 
i:Y/Y/n/Y 



-1 

* /* /* /* 


i: n/n/n/n 
i: n/n/n/n 


Spoiler 

8 

* /* /* /* 

*/*/*/* 

A 

i: n/n/n/n 
i : n/n/n/n 



3 



A 

i : n/n/n/n 
i: n/n/n/n 



1 

* /* /* /* 


i: n/n/n/n 
i: n/n/n/n 



Y/Y/Y/Y indicates correct identification using the 30- , 20- , 10-, 
and 1 -sample data windows. 

n indicates failure not correctly identified. 

i indicates identification based on maximum value of correlation, 
i indicates identification based on maximum value of normalized 
correlation. 

* indicates failure not detected. 
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TABLE IX.- NORMALIZED CORRELATIONS FOR A 20-SAMPLE WINDOW WITH 
AN EIGENVALUE OF 0.5 


Failure 

Type 

Magnitude, 

degrees 

Elevator 

10 


3 


1 


Turbulence 


Medium 


0.506 

.394 

.511 

.499 


0.123 

.108 

.122 

.123 


Throttle 


0.453 

.375 

.455 

.448 


Stabilizer 


Spoiler 


0.715 

.746 

.713 

.709 


Heavy 


1 .014 
.960 
1 .015 
1 .007 

1 .005 
.984 
1 .005 
.998 


1 .001 
.987 
1 .000 
.995 

1 .000 
.993 
.999 
.994 


0.986 
1 .046 
.979 
.981 

1 .008 
.969 
1 .010 
1 .002 

.997 
1 .004 
.996 
.992 


.238 
.377 
1 .232 
1 .231 

1 .091 
1.113 
1 .088 
1 .084 

1 .031 
1 .041 
1 .029 
1 .024 


Thunderstorm 


2.818 

2.970 

2.823 

2.799 


Values listed in order of 























TABLE X.- FAILURE DETECTION PERFORMANCE WITH LINEAR MEASUREMENTS AND 
THRESHOLDS SET AT NO TURBULENCE LEVEL 


Failure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

Heavy 

Thunderstorm 

Elevator 

10 

Y/Y/Y/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 



•3 



#Y/Y/Y/Y 



•3 

1 

n/n/n/n 


Y/Y/Y/Y 

#Y/Y/Y/Y 


Throttle 

40 

n/n/n/n 

Y/Y/Y/n 

Y/Y/Y/Y 

#Y/Y/Y/Y 



12 






4 

n/n/n/n 


Y/Y/Y/Y 

#Y/Y/Y/Y 


Stabilizer 

-6 

n/n/n/n 

Y/Y/Y/n 

Y/Y/Y/Y 



•3 



#Y/Y/Y/Y 



<3 

-i 

n/n/n/n 


Y/Y/Y/Y 

#Y/Y/Y/Y 


Spoi ler 

8 

■7 

Y/Y/Y/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 



1 

Y/Y/Y/Y 


Y/Y/Y/Y 



Y/Y/Y/Y indicates detection using the 30-, 20-, 10-, and 1 -sample 
windows . 

n indicates failure not detected. 

# no steady state winds. 




TABLE XI.- FAILURE DETECTION PERFORMANCE WITH LINEAR MEASUREMENTS AND 
THRESHOLDS SET AT HEAVY TURBULENCE LEVEL 




Failure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

— 

Heavy 

Thunderstorm 

Elevator 

10 

n/n/n/n 

n/n/n/n 

n/n/n/Y 



o 



#Y/n/n/Y 



i 

n/n/n/n 


n/n/n/Y 

#n/n/n/Y 


Throttle 

40 

n/n/n/n 

n/n/n/n 

n/n/n/n 

#n/n/n/n 



12 






4 

n/n/n/n 


n/n/n/n 

#n/n/n/Y 


Stabilizer 

-6 

n/n/n/n 

n/n/n/n 

n/n/n/n 






#n/n/n/n 



-1 

n/n/n/n 


n/n/n/n 

#n/n/n/Y 


Spoiler 

8 

Y/Y/Y/Y 

Y/Y/Y/Y 

Y/Y/Y/Y 



i 

n/Y/Y/Y 


Y/Y/Y/Y 



Y/Y/Y/Y indicates detection using the 30-, 20-, 10-, and 1 -sample 
» windows . 

n indicates failure not detected. 

# no steady state winds. 
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TABLE XII.- FAILURE IDENTIFICATION PERFORMANCE WITH LINEAR MEASUREMENTS: 

FAILURE CORRECTLY IDENTIFIED 


Failure 

Turbulence 

Type 

Magnitude, 

degrees 

None 

Medium 

Heavy 

Thunderstorm 

Elevator 

10 

*/*/*/* 

it fit fit fit 

i :*/*/*/n 
i : */*/*/n 



3 

1 

*/*/*/* 


i: Y/* /*/n 
i : n/*/*/Y 

A 

i :*/*/* /n 
i :*/*/* /n 






A 

i :*/*/* /n 
I:*/*/*/Y 


Throttle 

40 

* /* /* 

* fit fit fit 

*/*/*/* 



12 

4 

*/* fit fit 


* /* /* /* 
* /* /* /* 






A 

i:*/*/*/n 
i ; *f*f*/n 


Stabilizer 

-6 

* fit fit fit 

* /* /* /* 

* /* /* /* 



3 

-1 

* /* /* fit 


* /* /* /* 
* /* /* /* 






A 

i : */*/*/n 
i : */*/*/ n 


Spoiler 

8 

3 

1 

A 

i :n/n/n/n 
i:n/n/n/n 

A 

i:*/n/n/n 
i : */Y/n/n 

A 

i:n/n/n/n 
i : n/n/n/n 

A 

i: n/n/n/n 
i : n/n/n/n 

A 

i:n/n/n/r. 
i :n/n/Y/n 

/ 


Y/Y/Y/Y indicates correct identification using the 30-, 20-, 10-, and 
1 -sample data windows. 

n indicates failure not correctly identified, 
i indicates ID based on maximum value of correlation, 
i indicates ID based on maximum value of normalized correlation. 

* indicates failure not detected. 


¥ 


4 
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TABLE XIII.- NORMALIZED CORRELATIONS FOR A 20-SAMPLE DATA WINDOW 

WITH LINEAR MEASUREMENTS 


Failure 

Type 

Magnitude, 

degrees 

Elevator 

10 


3 


1 

Throttle 

40 


12 


4 

Stabilizer 

-6 


3 


-1 

Spoiler 

8 


3 


1 


Turbulence 



1 .003 
.980 
1 .021 
.998 


0.970 

.791 

.976 

.964 


0.960 
.957 
.9 37 
.960 


3.580 

3.665 

3.494 

3.607 

1.305 
1 .302 
1 .294 
1 .305 


Medium 


1 .07' 
.96 
1 .16 
1 .011 




1 .043 
.996 
1 .120 
.977 


1 .034 
.954 
1 .083 
.972 


3.654 

3.644 

3.648 

3.620 


Heavy 

w/ss wind 

no ss wind 

0.921 . 

0.929 

.932 

.979 

.967 

.954 

.901 

.933 

.909 

.917 

.923 

.970 

.946 

.932 

.888 

.920 

0.903 

0.911 

.749 

.797 

.943 

.929 

.878 

.910 

.908 

.916 

.915 

.941 

.944 

.930 

.887 

.918 

0.898 

0.906 

.923 

.971 

.920 

.906 

.877 

.909 

.906 

.914 

.922 

.969 

.940 

.926 

• 885 

.917 



1.141 
1 .204 
1 .1 34 
1 .164 


Values listed in order of 
ss = steady state. 



























TABLE XIV.- VALUES OF STEADY STATE CORRELATION C(J,K) FOR HARDOVER FAILURES 


X 

1 

2 

3 

4 

5 

6 

1 

0.163E-3 

-0.996E-4 

-0.205E-3 

0.495E-1 

-0.188E-3 

-0.294E-3 


• 355E-5 

.1 04E-2 

-.437E-5 

- .471 E-2 

.856E-4 

.439E-4 


.296E-3 

.1 22E-4 

-.37 IE- 3 

•272E-1 

.255E-3 

-.923E-4 


- .1 01 E-3 

.1 23E-3 

.1 27E-3 

-.432E-1 

.600E-3 

.359E-3 

5 

.762E-4 

.893E-4 

-.953E-4 

-.724E-2 

.994E-3 

.261 E-3 

6 

— .747E-4 

.1 25E— 3 

.941 E-4 

-.387E-1 

.713E-3 

. 364E-3 















Time, sec 


(a) 

Figure 


Aircraft states - pitch, velocity, and angle-of-attack . 

1 Time history plots for an 8 degree spoiler failure at 
3 seconds with no turbulence. 



5 


6 


Time, sec 


(b) Aircraft states - pitch rate, thrust, and stabilizer 


Figure 1,- Continued 
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(a) Aircraft states - pitch, velocity, and angle-of -attack . 

Figure 2.- Time history plots for an 8 degree spoiler failure at 
3 seconds in heavy turbulence. 
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(b) Aircraft states - pitch rate, thrust, and stabilizer. 
Figure 2.- Continued. 
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